Lucene search

K
vulnrichmentLinuxVULNRICHMENT:CVE-2024-36975
HistoryJun 18, 2024 - 7:20 p.m.

CVE-2024-36975 KEYS: trusted: Do not use WARN when encode fails

2024-06-1819:20:24
Linux
github.com
1
linux kernel
vulnerability
cve-2024-36975
keys
trusted
asn1_encode_sequence()
warn
encode fails
pr_err
stack trace

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Do not use WARN when encode fails

When asn1_encode_sequence() fails, WARN is not the correct solution.

  1. asn1_encode_sequence() is not an internal function (located
    in lib/asn1_encode.c).
  2. Location is known, which makes the stack trace useless.
  3. Results a crash if panic_on_warn is set.

It is also noteworthy that the use of WARN is undocumented, and it
should be avoided unless there is a carefully considered rationale to
use it.

Replace WARN with pr_err, and print the return value instead, which is
only useful piece of information.

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

partial